Exchange Reporter Plus CVE-2025-5342

Exploitation requires an authenticated account on ManageEngine Exchange Reporter Plus (through build 5721) with access to the search module/feature; the attacker then supplies a crafted search input that induces catastrophic regular-expression backtracking. Limiting factors: valid credentials are required (PR:L, so this is not remote-unauthenticated), impact is confined to availability (service hang/CPU exhaustion) with no data exposure or modification, and network reachability to the web interface is needed. The attack surface is narrowed to insiders or holders of compromised/low-privilege credentials.

This is a moderate, not top-tier, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) describes a network-reachable, low-complexity denial-of-service that requires authentication (PR:L) and affects only availability - no confidentiality or integrity impact, consistent with CWE-400 (uncontrolled resource consumption) and the ReDoS classification. EPSS is modest at 1.14% (66th percentile), indicating below-average predicted exploitation likelihood. There is no CISA KEV listing and no public exploit identified at time of analysis, so there is no evidence of active or opportunistic exploitation. The signals are internally consistent: a authenticated availability-only ReDoS with no confirmed exploitation is a real but limited issue - it is NOT a drop-everything flaw. The main caveat is the PR:L requirement: a valid (even low-privilege) account is needed to reach the search module, which meaningfully constrains the attacker population to insiders or those with compromised credentials.

An authenticated low-privilege user of Exchange Reporter Plus submits a specially crafted search string containing a pathological pattern that triggers catastrophic regular-expression backtracking in the search module. The request consumes excessive CPU, degrading or hanging the reporting service and denying availability to other users. No public exploit code has been identified, so exploitation would require an attacker to independently craft the malicious input.